From 8e60ef054660863c94c00e0e85c3fab0509378ed Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Mon, 18 Dec 2017 15:46:07 +0900
Subject: [PATCH] =?UTF-8?q?=EC=98=81=EC=B9=B4=ED=8A=B8=20Reflected=20XSS?=
 =?UTF-8?q?=20=EC=B7=A8=EC=95=BD=EC=A0=90=20(17-0924)=20=20=EC=88=98?=
 =?UTF-8?q?=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 shop/orderinquiryview.php | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/shop/orderinquiryview.php b/shop/orderinquiryview.php
index d0b9fba07..d29843875 100644
--- a/shop/orderinquiryview.php
+++ b/shop/orderinquiryview.php
@@ -1,6 +1,8 @@
 <?php
 include_once('./_common.php');
 
+$od_id = isset($od_id) ? preg_replace('/[^A-Za-z0-9\-_]/', '', strip_tags($od_id)) : 0;
+
 if( isset($_GET['ini_noti']) && !isset($_GET['uid']) ){
     goto_url(G5_SHOP_URL.'/orderinquiry.php');
 }